Update dependencies and fix what the new lint rules caught

Every package moves to its newest in-major version, plus React 19.3, @convex-dev/auth 0.0.96 and next-plausible 4. The backend declares @auth/core and generates sign-in codes without oslo, which @convex-dev/auth no longer pulls in. The UseSend patch now actually removes the crypto import Convex refuses to bundle. The stricter react-hooks and typescript-eslint rules flagged the carousel, chart, image crop and mobile hook, which now pass.

scripts/patch-usesend.mjs

@@ -7,6 +7,15 @@ const __dirname = path.dirname(__filename);
 const usesendDir = path.join(__dirname, '..', 'node_modules', 'usesend-js');
 
 const ensureReplacement = (content, searchValue, replaceValue, filePath) => {
+  // Removal step (empty replacement): it's already applied once the search
+  // snippet is gone. Guard on searchValue, not replaceValue — every string
+  // "includes" the empty string, which would make this a silent no-op.
+  if (replaceValue === '') {
+    return content.includes(searchValue)
+      ? content.replace(searchValue, replaceValue)
+      : content;
+  }
+
   if (content.includes(replaceValue)) {
     return content;
   }